{{- if and ( .Values.noHelmHooks ) (eq .Values.controlPlane.environment "kubernetes") }}
  {{- $errorMessage := ".Values.noHelmHooks is set. You must manually create and label the system namespace with kuma.io/system-namespace: \"true\" before installing or upgrading the chart" }}
  {{- $systemNamespace := (lookup "v1" "Namespace" "" .Release.Namespace) }}
  {{- if not $systemNamespace }}
      {{- fail $errorMessage }}
    {{- end }}
  {{- $systemNamespaceLabels := ($systemNamespace).metadata.labels }}
  {{- if ne (get $systemNamespaceLabels "kuma.io/system-namespace") "true" }}
    {{- fail $errorMessage }}
  {{- end }}
{{- else}}
  {{- if .Values.patchSystemNamespace }}
    {{- $serviceAccountName := printf "%s-patch-ns-job" (include "kuma.name" .) }}
apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ $serviceAccountName }}
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/hook": "pre-install"
    "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
  labels:
  {{- include "kuma.labels" . | nindent 4 }}
{{- with .Values.global.imagePullSecrets }}
imagePullSecrets:
  {{- range . }}
  - name: {{ . | quote }}
  {{- end }}
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ include "kuma.name" . }}-patch-ns-job
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/hook": "pre-install"
    "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
  labels:
  {{- include "kuma.labels" . | nindent 4 }}
rules:
  - apiGroups:
      - ""
    resources:
      - namespaces
    resourceNames:
      - {{ .Release.Namespace }}
    verbs:
      - get
      - patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ include "kuma.name" . }}-patch-ns-job
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/hook": "pre-install"
    "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
  labels:
  {{- include "kuma.labels" . | nindent 4 }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ include "kuma.name" . }}-patch-ns-job
subjects:
  - kind: ServiceAccount
    name: {{ $serviceAccountName }}
    namespace: {{ .Release.Namespace }}
---
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "kuma.name" . }}-patch-ns
  namespace: {{ .Release.Namespace }}
  labels:
  {{ include "kuma.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": "pre-install"
    {{/* Ensure the job is created after the RBAC resources */}}
    "helm.sh/hook-weight": "5"
    "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded,hook-failed"
spec:
  template:
    metadata:
      name: {{ template "kuma.name" . }}-patch-ns-script
      labels:
    {{ include "kuma.labels" . | nindent 8 }}
    spec:
      serviceAccountName: {{ $serviceAccountName }}
      {{- with .Values.hooks.nodeSelector }}
      nodeSelector:
      {{ toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.hooks.tolerations }}
      tolerations:
      {{ toYaml . | nindent 8 }}
      {{- end }}
      restartPolicy: OnFailure
      securityContext:
      {{- toYaml .Values.hooks.podSecurityContext | trim | nindent 8 }}
      containers:
        - name: pre-install-job
          image: "{{ .Values.kubectl.image.registry }}/{{ .Values.kubectl.image.repository }}:{{ .Values.kubectl.image.tag }}"
          securityContext:
          {{- toYaml (mergeOverwrite (dict "runAsUser" 65534) .Values.hooks.containerSecurityContext) | trim | nindent 12 }}
          resources:
             requests:
               cpu: "100m"
               memory: "256Mi"
             limits:
               cpu: "100m"
               memory: "256Mi"
          command:
            - 'kubectl'
            - 'patch'
            - 'namespace'
            - {{ .Release.Namespace | quote }}
            - '--type'
            - 'merge'
            - '--patch'
            - '{ "metadata": { "labels": { "kuma.io/system-namespace": "true" } } }'
  {{- end }}
{{- end }}
